Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
More Than A Half-Million Servers Exposed To Heartbleed Flaw
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
Markus5
50%
50%
Markus5,
User Rank: Strategist
4/10/2014 | 4:01:31 AM
Re: Password changes
Well Amazon has already fixed the flaw on their side so it should be safe to change the passwords on Amazon from my point of view
rradina
50%
50%
rradina,
User Rank: Apprentice
4/9/2014 | 7:40:12 PM
Scope
Does anyone know if this affects a typical consumer-grade router?  I have secure Telnet forwarded to one of the WiFi routers in my house that's running dd-wrt.  I telnet into that router to send a majic packet to sleeping machines if I need to remote desktop to them.  Does anyone know if OpenSSL provides the SSL implementation for secure telnet on a typical Linux router build?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/9/2014 | 7:02:37 PM
Leveraging OpenSSL
I was explaining this vulnerability at work today and I asked a question but was given an answer that I am unsure is entirely true so I wanted to bring it here. I stated that OpenSSL is just one platform of SSL to be used. This vulnerability also only happens with a singular version of the platform. Someone I spoke with stated that this is leveraged by Apache servers, which to date comprise of around 53% of the server types out there. Looking at the stats in this article this may be the reason for the high percentage of confirmed compromised servers.

The statement made by the other party was that ALL Apache servers would leverage OpenSSL. My statement was that Apache servers don't need to be running that platform of SSL but I am not entirely certain. Do Apache servers only run OpenSSL or can it run other SSL platforms? Thanks, 
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
4/9/2014 | 6:39:12 PM
Re: Password changes
Isn't it always time to change passwords? The rate at which vulnerabilites are uncovered seems to exceed my typing speed.
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
4/9/2014 | 5:28:46 PM
Password changes
So is it time to go change Amazon.com passwords? Also has Bruce Schneier ever give a bug an 11 on the 1 to 10 scale before?
<<   <   Page 2 / 2


COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10737
PUBLISHED: 2020-05-27
A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the hom...
CVE-2020-13622
PUBLISHED: 2020-05-27
JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data.
CVE-2020-13623
PUBLISHED: 2020-05-27
JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation.
CVE-2020-13616
PUBLISHED: 2020-05-26
The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
CVE-2020-13614
PUBLISHED: 2020-05-26
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.